chore(deps): bump the npm_and_yarn group across 8 directories with 2 updates by dependabot[bot] · Pull Request #3513 · BoundaryML/baml

dependabot · 2026-05-11T20:17:37Z

Bumps the npm_and_yarn group with 2 updates in the / directory: next and mermaid.
Bumps the npm_and_yarn group with 1 update in the /integ-tests/react directory: next.
Bumps the npm_and_yarn group with 1 update in the /typescript/apps/beps directory: next.
Bumps the npm_and_yarn group with 1 update in the /typescript/apps/fiddle-web-app directory: next.
Bumps the npm_and_yarn group with 1 update in the /typescript/apps/sage-backend directory: next.
Bumps the npm_and_yarn group with 1 update in the /typescript/packages/nextjs-plugin directory: next.
Bumps the npm_and_yarn group with 1 update in the /typescript/packages/ui directory: next.
Bumps the npm_and_yarn group with 1 update in the /typescript2/app-promptfiddle directory: next.

Updates next from 15.2.7 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

9ff92ce v15.5.18
00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
62c97ab v15.5.17
423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
fa78739 Turbopack: Fix middleware matcher suffix (#93590)
36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
36589b5 [backport][test] Pin package manager to patch versions (#93596)
ad6fd4e v15.5.16
79d7dff Ignore malformed CSP nonce headers (#103)
c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates mermaid from 11.9.0 to 11.15.0

Release notes

Sourced from mermaid's releases.

mermaid@11.15.0

Minor Changes
#7174 0aca217 Thanks @milesspencer35! - feat(sequence): Add support for decimal start and increment values in the autonumber directive

#7512 8e17492 Thanks @aruncveli! - feat(flowchart): add datastore shape

In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with A@{ shape: datastore, label: "Datastore" }.

#6440 9ad8dde Thanks @yordis, @lgazo! - feat: add Event Modeling diagram

#7707 27db774 Thanks @txmxthy! - feat(architecture): expose four fcose layout knobs for architecture-beta diagrams (nodeSeparation, idealEdgeLengthMultiplier, edgeElasticity, numIter) so authors can tune layout density and spread overlapping siblings without changing diagram source
#7604 bf9502f Thanks @M-a-c! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting

If you have namespaces in class diagrams that use .s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set class.hierarchicalNamespaces=false in your mermaid config:
config:
  class:
    hierarchicalNamespaces: false
#7272 88cdd3d Thanks @xinbenlv! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors
Patch Changes

#7737 e9b0f34 Thanks @ashishjain0512! - fix: prevent unbalanced CSS styles in classDefs

#7737 37ff937 Thanks @ashishjain0512! - fix: create CSS styles using the CSSOM

This removes some invalid CSS and normalizes some CSS formatting.

#7508 bfe60cc Thanks @biiab! - fix(stateDiagram): end note now only closes a note when used on a new line

#7737 faafb5d Thanks @ashishjain0512! - fix(gantt): add iteration limit for excludes field

#7737 65f8be2 Thanks @ashishjain0512! - fix: disallow some CSS at-rules in custom CSS

#7726 1502f32 Thanks @aloisklink! - fix(wardley): fix unnecessary sanitization of text

#7578 1f98db8 Thanks @Gaston202! - fix(class): self-referential class multiplicity labels no longer rendered multiple times

Fixes #7560. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.

#7592 2343e38 Thanks @knsv-bot! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams

#7589 7fb9509 Thanks @NYCU-Chung! - fix(block): prevent column widths from shrinking when mixing different column spans

#7632 3f9e0f1 Thanks @ekiauhce! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams

... (truncated)

Commits

41646df Merge pull request #7739 from aloisklink/ci/fix-release
2671f5c docs: fix v11.15.0 release
f4bf04b Merge pull request #7738 from mermaid-js/changeset-release/master
abfb563 Version Packages
60b289f Release Candidate 11.15.0 (#7737)
d37c0db Merge pull request #7730 from aloisklink/fix/fix-edgeLabelRightLeft-changes
5ab5a28 docs: improve nested namespace changeset
18f8b4c fix: revert endEdgeLabelLeft/endEdgeLabelRight change
504b2eb Merge pull request #7726 from aloisklink/fix/correct-unnecessary-html-escapes...
1502f32 fix(wardley): fix unnecessary sanitization of text
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mermaid since your current version.

Updates next from 15.2.7 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

9ff92ce v15.5.18
00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
62c97ab v15.5.17
423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
fa78739 Turbopack: Fix middleware matcher suffix (#93590)
36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
36589b5 [backport][test] Pin package manager to patch versions (#93596)
ad6fd4e v15.5.16
79d7dff Ignore malformed CSP nonce headers (#103)
c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates mermaid from 11.9.0 to 11.15.0

Release notes

Sourced from mermaid's releases.

mermaid@11.15.0

Minor Changes
#7174 0aca217 Thanks @milesspencer35! - feat(sequence): Add support for decimal start and increment values in the autonumber directive

#7512 8e17492 Thanks @aruncveli! - feat(flowchart): add datastore shape

In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with A@{ shape: datastore, label: "Datastore" }.

#6440 9ad8dde Thanks @yordis, @lgazo! - feat: add Event Modeling diagram

#7707 27db774 Thanks @txmxthy! - feat(architecture): expose four fcose layout knobs for architecture-beta diagrams (nodeSeparation, idealEdgeLengthMultiplier, edgeElasticity, numIter) so authors can tune layout density and spread overlapping siblings without changing diagram source
#7604 bf9502f Thanks @M-a-c! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting

If you have namespaces in class diagrams that use .s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set class.hierarchicalNamespaces=false in your mermaid config:
config:
  class:
    hierarchicalNamespaces: false
#7272 88cdd3d Thanks @xinbenlv! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors
Patch Changes

#7737 e9b0f34 Thanks @ashishjain0512! - fix: prevent unbalanced CSS styles in classDefs

#7737 37ff937 Thanks @ashishjain0512! - fix: create CSS styles using the CSSOM

This removes some invalid CSS and normalizes some CSS formatting.

#7508 bfe60cc Thanks @biiab! - fix(stateDiagram): end note now only closes a note when used on a new line

#7737 faafb5d Thanks @ashishjain0512! - fix(gantt): add iteration limit for excludes field

#7737 65f8be2 Thanks @ashishjain0512! - fix: disallow some CSS at-rules in custom CSS

#7726 1502f32 Thanks @aloisklink! - fix(wardley): fix unnecessary sanitization of text

#7578 1f98db8 Thanks @Gaston202! - fix(class): self-referential class multiplicity labels no longer rendered multiple times

Fixes #7560. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.

#7592 2343e38 Thanks @knsv-bot! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams

#7589 7fb9509 Thanks @NYCU-Chung! - fix(block): prevent column widths from shrinking when mixing different column spans

#7632 3f9e0f1 Thanks @ekiauhce! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams

... (truncated)

Commits

41646df Merge pull request #7739 from aloisklink/ci/fix-release
2671f5c docs: fix v11.15.0 release
f4bf04b Merge pull request #7738 from mermaid-js/changeset-release/master
abfb563 Version Packages
60b289f Release Candidate 11.15.0 (#7737)
d37c0db Merge pull request #7730 from aloisklink/fix/fix-edgeLabelRightLeft-changes
5ab5a28 docs: improve nested namespace changeset
18f8b4c fix: revert endEdgeLabelLeft/endEdgeLabelRight change
504b2eb Merge pull request #7726 from aloisklink/fix/correct-unnecessary-html-escapes...
1502f32 fix(wardley): fix unnecessary sanitization of text
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mermaid since your current version.

Updates next from 15.2.7 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

9ff92ce v15.5.18
00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
62c97ab v15.5.17
423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
fa78739 Turbopack: Fix middleware matcher suffix (#93590)
36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
36589b5 [backport][test] Pin package manager to patch versions (#93596)
ad6fd4e v15.5.16
79d7dff Ignore malformed CSP nonce headers (#103)
c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates mermaid from 11.9.0 to 11.15.0

Release notes

Sourced from mermaid's releases.

mermaid@11.15.0

Minor Changes
#7174 0aca217 Thanks @milesspencer35! - feat(sequence): Add support for decimal start and increment values in the autonumber directive

#7512 8e17492 Thanks @aruncveli! - feat(flowchart): add datastore shape

In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with A@{ shape: datastore, label: "Datastore" }.

#6440 9ad8dde Thanks @yordis, @lgazo! - feat: add Event Modeling diagram

#7707 27db774 Thanks @txmxthy! - feat(architecture): expose four fcose layout knobs for architecture-beta diagrams (nodeSeparation, idealEdgeLengthMultiplier, edgeElasticity, numIter) so authors can tune layout density and spread overlapping siblings without changing diagram source
#7604 bf9502f Thanks @M-a-c! - feat(class): add nested namespace support for class diagrams via dot notation and syntactic nesting

If you have namespaces in class diagrams that use .s already and want to render them without nesting (≤v11.14.0 behaviour), you can use set class.hierarchicalNamespaces=false in your mermaid config:
config:
  class:
    hierarchicalNamespaces: false
#7272 88cdd3d Thanks @xinbenlv! - feat(sankey): add outlined label style, configurable nodeWidth/nodePadding, and custom node colors
Patch Changes

#7737 e9b0f34 Thanks @ashishjain0512! - fix: prevent unbalanced CSS styles in classDefs

#7737 37ff937 Thanks @ashishjain0512! - fix: create CSS styles using the CSSOM

This removes some invalid CSS and normalizes some CSS formatting.

#7508 bfe60cc Thanks @biiab! - fix(stateDiagram): end note now only closes a note when used on a new line

#7737 faafb5d Thanks @ashishjain0512! - fix(gantt): add iteration limit for excludes field

#7737 65f8be2 Thanks @ashishjain0512! - fix: disallow some CSS at-rules in custom CSS

#7726 1502f32 Thanks @aloisklink! - fix(wardley): fix unnecessary sanitization of text

#7578 1f98db8 Thanks @Gaston202! - fix(class): self-referential class multiplicity labels no longer rendered multiple times

Fixes #7560. Resolves an issue where cardinality labels on self-referential class relationships were rendered three times due to edge splitting in the dagre layout. The fix ensures that each sub-edge only carries its relevant label positions.

#7592 2343e38 Thanks @knsv-bot! - fix(sequence): add background box behind alt/else section title labels in sequence diagrams

#7589 7fb9509 Thanks @NYCU-Chung! - fix(block): prevent column widths from shrinking when mixing different column spans

#7632 3f9e0f1 Thanks @ekiauhce! - fix(sequence): correct messageAlign label position for right-to-left arrows in sequence diagrams

... (truncated)

Commits

41646df Merge pull request #7739 from aloisklink/ci/fix-release
2671f5c docs: fix v11.15.0 release
f4bf04b Merge pull request #7738 from mermaid-js/changeset-release/master
abfb563 Version Packages
60b289f Release Candidate 11.15.0 (#7737)
d37c0db Merge pull request #7730 from aloisklink/fix/fix-edgeLabelRightLeft-changes
5ab5a28 docs: improve nested namespace changeset
18f8b4c fix: revert endEdgeLabelLeft/endEdgeLabelRight change
504b2eb Merge pull request #7726 from aloisklink/fix/correct-unnecessary-html-escapes...
1502f32 fix(wardley): fix unnecessary sanitization of text
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for mermaid since your current version.

Updates next from 15.2.7 to 15.5.18

Release notes

Sourced from next's releases.

v15.5.18

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-26hh-7cqf-hhc6: Middleware / Proxy bypass in App Router applications via segment-prefetch routes - Incomplete Fix Follow-Up

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.16

This release contains security fixes for the following advisories:

High:

GHSA-8h8q-6873-q5fj: Denial of Service with Server Components

GHSA-267c-6grr-h53f: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

GHSA-mg66-mrh9-m8jx: Denial of Service via connection exhaustion in applications using Cache Components

GHSA-492v-c6pp-mqqv: Middleware / Proxy bypass through dynamic route parameter injection

GHSA-c4j6-fc7j-m34r: Server-side request forgery in applications using WebSocket upgrades

GHSA-36qx-fr4f-26g5: Middleware / Proxy bypass in Pages Router applications using i18n

Moderate:

GHSA-ffhc-5mcf-pf4q: Cross-site scripting in App Router applications using CSP nonces

GHSA-gx5p-jg67-6x7h: Cross-site scripting in beforeInteractive scripts with untrusted input

GHSA-h64f-5h5j-jqjh: Denial of Service in the Image Optimization API

GHSA-wfc6-r584-vfw7: Cache poisoning in React Server Component responses

Low:

GHSA-vfv6-92ff-j949: Cache poisoning via collisions in React Server Component cache-busting

GHSA-3g8h-86w9-wvmq: Middleware / Proxy redirects can be cache-poisoned

v15.5.15

Please refer the following changelogs for more information about this security release:

https://vercel.com/changelog/summary-of-cve-2026-23869

v15.5.14

[!NOTE]

... (truncated)

Commits

9ff92ce v15.5.18
00ebe23 [backport] Disable build caches for production/staging/force-preview deploys ...
62c97ab v15.5.17
423623a Turbopack: Match proxy matchers with webpack implementation (#93594)
fa78739 Turbopack: Fix middleware matcher suffix (#93590)
36e62c6 [backport] Turbopack: more strict vergen setup (#93588)
36589b5 [backport][test] Pin package manager to patch versions (#93596)
ad6fd4e v15.5.16
79d7dff Ignore malformed CSP nonce headers (#103)
c4f6908 router-server: guard upgrade proxy against absolute-url SSRF (#77) (#102)
Additional commits viewable in compare view

Maintainer changes

This version was pushed to npm by GitHub Actions, a new releaser for next since your current version.

Updates mermaid from 11.9.0 to 11.15.0

Release notes

Sourced from mermaid's releases.

mermaid@11.15.0

Minor Changes

#7174 0aca217 Thanks @milesspencer35! - feat(sequence): Add support for decimal start and increment values in the autonumber directive

#7512 8e17492 Thanks @aruncveli! - feat(flowchart): add datastore shape

In Data flow diagrams, a datastore/warehouse/file/database is used to represent data persistence. It is denoted by a rectangle with only top and bottom borders, and can be used in flowcharts with A@{ shape: datastore, label: "Datastore" }.

#6440 9ad8dde Thanks

vercel · 2026-05-11T20:17:43Z

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
beps	Ready	Preview, Comment	Jun 3, 2026 3:03am
promptfiddle	Ready	Preview, Comment	Jun 3, 2026 3:03am
promptfiddle2	Error		Jun 3, 2026 3:03am

github-actions · 2026-06-03T02:44:11Z

⏭️ Performance benchmarks were skipped

Perf benchmarks (CodSpeed) are opt-in on pull requests — they no longer run on every push. They always run automatically after merge to canary/main.

To run them on this PR, do any of the following, then push a commit (or re-run CI):

Add RUN_CODSPEED=1 to the PR description, or
Include run-perf or /perf in the PR title or any commit message.

dependabot Bot added dependencies Pull requests that update a dependency file javascript Pull requests that update javascript code labels May 11, 2026

vercel Bot deployed to Preview – beps May 11, 2026 20:18 View deployment

dependabot Bot had a problem deploying to boundary-tools-dev May 11, 2026 20:20 Failure

vercel Bot deployed to Preview – promptfiddle May 11, 2026 20:36 View deployment

dependabot Bot force-pushed the dependabot/npm_and_yarn/npm_and_yarn-402df9c2bd branch from 2f3291f to 8880994 Compare June 3, 2026 02:43

dependabot Bot had a problem deploying to boundary-tools-dev June 3, 2026 02:44 Failure

vercel Bot had a problem deploying to Preview – promptfiddle2 June 3, 2026 02:44 Failure

vercel Bot deployed to Preview – beps June 3, 2026 02:44 View deployment

vercel Bot deployed to Preview – promptfiddle June 3, 2026 03:03 View deployment

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore(deps): bump the npm_and_yarn group across 8 directories with 2 updates#3513

chore(deps): bump the npm_and_yarn group across 8 directories with 2 updates#3513
dependabot[bot] wants to merge 1 commit into
canaryfrom
dependabot/npm_and_yarn/npm_and_yarn-402df9c2bd

dependabot Bot commented on behalf of github May 11, 2026 •

edited

Loading

Uh oh!

vercel Bot commented May 11, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 3, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Uh oh!

Conversation

dependabot Bot commented on behalf of github May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

v15.5.18

v15.5.16

v15.5.15

v15.5.14

mermaid@11.15.0

Minor Changes

Patch Changes

v15.5.18

v15.5.16

v15.5.15

v15.5.14

mermaid@11.15.0

Minor Changes

Patch Changes

v15.5.18

v15.5.16

v15.5.15

v15.5.14

mermaid@11.15.0

Minor Changes

Patch Changes

v15.5.18

v15.5.16

v15.5.15

v15.5.14

mermaid@11.15.0

Minor Changes

Uh oh!

vercel Bot commented May 11, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jun 3, 2026

⏭️ Performance benchmarks were skipped

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

dependabot Bot commented on behalf of github May 11, 2026 •

edited

Loading

vercel Bot commented May 11, 2026 •

edited

Loading